Hacker or criminal? Repairing the reputation of the infosec community

Council across a range of disciplines including media relations employee awareness incident response hacker relations disclosure incentives social engagement and public policy she also serves as a public relations goon for Defcon and Roots Asylum she holds a master of science in corporate public relations from Boston University uh where she also taught courses on corporate Communications all right she's here she's hyped up on caffeine and we had an 20 ft of mic cable installed during lunch because apparently she's a shark who can't be chained to the podium or she might die uh and she talks fast even in high heels I don't know I read it on Twitter it's got to be true at any rate please put your hands together for our

next speaker Melanie ensen thank you can can everybody hear me okay in the back it's been a long time since I've done karaoke so this kind of mic setup is a little awkward see case in point awesome thank you um so per usual bides um culture want to off with a couple of caveats and disclosures for me um obviously nothing I say represents anyone I have ever worked for including my employers or my clients these are my own crazy ideas um so please don't hold them against anyone but myself um also I am not an engineer um my education background is in um biological sciences and Communications um but I have spent um I guess the good

part of a decade working specifically with um security team so that is my background that's where I'm coming from um and so I want to share with you guys just a little bit of insight and experience that I've had coming from the communication side um in how we can help repair some of the reputational challenges um of the security Community um so I want to start uh with a couple of questions questions for you guys who is familiar with Title 18 couple people really just a couple people yeah um so for those of you who aren't familiar with Title 18 is part of um a previous um regulatory um and legislation um around uh computer

security uh and data information security um it's unfortunately a lot of the reasons why people that I love and and care about um accidentally end up in jail um for trying to do security research um how many of you believe that some of the current regulation and and legislation and a lot of it was discussed this morning is actually going to help protect data security now I don't mean protect consumers and keep companies from being like total like douchebags but I mean actually going to help us secure things in a better way and anybody so so this brings me to the impetus of why I'm here today our story sucks you guys it just does uh in the public space we kind of

fall into two categories when it comes to security we're either the super antisocial totally inept engineering nerd um or we're the [ __ ] who is bashing people on Twitter um and here's the problem with that is our Securities as a community are very very loud and that is what we're projecting to governments what we're projecting to Consumers um and so for those of you who don't recognize this guy um Biff from uh back to the future if you'll remember uh the way that that the movie is set up he starts as really kind of being that bully right he's got this Rockstar God complex um which of course nobody in infosec has right um and you know he he's picking on the

little guy um and not only does he end up being like a I can't even say glorified auto mechanic um but we're all rooting for him to fail right we don't want him to win and this is our problem is right now this is the reputation of the security Community outside of our culture right so if you go talk to The Regulators if you go talk to my mom who is the epitome of a non-technical consumer audience this is what they think of us and nobody thinks that we can handle these challenges on our own and nobody thinks that we either have the maturity or the skill set to secure consumers and um the internet and

Technologies the way that we need to and so what happens is people get scared and when people get scared the government steps in um we've heard a lot of people uh this morning already talk about how much money is in security these days whether it's um the government finding companies or individuals or whether it's you know vendors and others on the commercial side who are really feeding on the sphere that we've allowed to take place uh within the public discourse um and and they want us to fail you guys they don't think we can do it and so I'm here to provide a couple of suggestions want to get the conversation started on what can we do particularly as security

researchers or as security Engineers to help shift that perception because if we don't take control of our message and of our story this is how we're going to end up so couple of Basics here um I mentioned a little bit kind of what people think of security right versus what I know we actually are um the security Community is incredibly imaginative everything that you guys do on a day-to-day basis is incredibly creative problem solving people give you the impossible and expect you to find a solution it's also incredibly nuanced I bet there are probably no more than four people in this room who do the exact same thing in security there's so many areas where you can be an expert so many

ways that you can contribute um in so many different skill sets I mean I'm here as living proof that there's a lot more than technical knowledge that is required for us to be successful in our goals uh I I want to talk about the creativity of the community as well there are a lot of musicians a lot of artists um that is a piece of our culture and our community that isn't really well represented when you think about um what's in the news media or the way that a consumer would think about a security engineer uh the security Community is incredibly charitable right I mean eff is a good example of that um there are a

lot of people here donating uh to a good cause simply because this is who we are and it's something that's important to us I think about organizations like hack for kids or uh Roots Asylum which takes place um at the Defcon conference every year these are engineers and professionals who volunteer their time and their resources and their expertise to educate children in the next generation of hackers and security Engineers again that's a really underrepresented piece of of who we are and then I also think that security Engineers are some of the most courageous people I've ever met I have seen Security Professionals go head-to-head with attorneys and CEOs and journalists to stand up for what they

believe in that is not a piece of our story that people recognize and that people are responding to instead they're thinking everything on what is that your your right side um that's what they think of us and because of that our parents or the government um who's often doing the parenting for us has to come and constantly slap our hand right nobody thinks that we actually have the capability to do the right thing and I think that is absolute [ __ ] and I think it's time that we actually take that back and show them who we really are so I want to talk a little bit about how we got here this is just a really

small representation of everything that happens in the world of security so you may fall into one of these areas you may cross several of them or you may just be a a small segment of of one of them but often we get get so laser focused on our own project or our own report or our own product we don't think about that the things that we say about security externally to people outside of our community Ricochet and has an impact on all of those things you as a researcher may say one thing to one reporter which leads to a vendor coming up with a complete snake oil response to that which is then going to force law

enforcement um to start looking for different types of behaviors and different patterns um I think it's also important to recognize that while we all have to work together we don't always agree um so your your policy makers and your law enforcement have a very different motivation and a very different agenda for participating in this conversation so I hope if nothing else you you know you guys walk away from from this talk specifically with a little bit of a broader perspective of how are the things that you say and the way that you communicate impacting the success of the community at large and how are your actions and your communication decisions um going to influence how the others in our

community respond so this is one of my favorite places um in the United States okay someone has been there this is the Beantown Pub uh in Boston um full disclosure I I don't like nature unless it involves like sand and a cocktail so this is really one of my favorite places in the country um one of the reasons why I love being toown Pub so much is because if you go to this bar you can order a cold locally brewed Sam Adams you can buy a Sam Adams club sandwich and if you sit near the window you can actually enjoy your very tasty meal while while looking at Sam Adams grave across the street um in the

cemetery that's always been a really cool experience for me uh particularly because I think of Sam Adams as I guess I would call him the chief Communications officer of the American Revolution think about what he had to accomplish um with those 13 dispar colonies half of which uh endorsed slavery and think about the The Branding and the communications required to achieve his goal which was American independence now you can argue for either side on who is the good guy or the bad guy in that dispute but you can't argue that Samuel Adams was incredibly effective as a communicator in bringing that Community together and moving forward to achieve um a shared goal now a couple of the things um that

made Sam Adams successful was that he understood some of the basics of public opinion so I'm going to share with you guys just a couple of basic um things that that were taught um as professional communicators um so you guys can can kind of have the same level set um as we go through the rest of the content so first culture sets the tone right and not our culture their culture so when you think about communicating with Regulators you think about communicating with uh Your Business Leaders when you think about communicating with consumers it's their culture right they're going to approach whatever you say and they're going to interpret your words through their perspective so think about um if you're

trying to get a proposal um approved or if you're trying to make a point if you're trying to shift the conversation in public discourse it's about what they believe first and then what we believe so how do we look through their lens and communicate um what we think is important I think um it was uh Lisa this morning who brought up the the Cyber dispute right so if the people you're trying to reach call it cyber security [ __ ] call it cyber security right it doesn't really it's their culture that sets the tone uh secondly uh samples represent the whole and this is this is why I'm so concerned right now with where we've

gotten as a community um because you know who's really loud in our community our insecurities our insecurities are so loud it's you know literally I think I don't know what it is about infosec that we just have this attraction for [ __ ] but they're really loud and that's who people think we are um and and that's not who we are right I mean think about that list of those incredibly positive contributions that we bring to society that people don't recognize because our Community representatives are not living up to the standard um that we should be holding them to people love a show um I'm always reminding my clients that the same crowd that cheers for your coronation is the

same crowd that's going to cheer when you get beheaded right drama sells um and so right now there's a lot of really negative drama that's being sold um in security from a Communications perspective uh we have an opportunity to change that you know is there a positive way that we can leverage that element of human nature um to communicate a more positive reputation for ourselves uh and lastly stimuli can be substituted so think back to to Samuel Adams um he was able to capture the attention of the colonists on something that they shared um and I think about some of the big events that he facilitating and quite honestly manufactured I mean we all know that the

Boston te party not in you know impromptu um event that took place that was specifically manufactured and facilitated to make a point and to capture people's attention and through that event he then just kind of flipped a switch and got people thinking about it's no longer about taxation without representation but it's now about our independence right he took it up a level because he had already captured people brought them in and then you just flipped that switch and so now was about a larger issue uh so I want to talk a little bit about what connects people to those broader issues um this diagram here on the left hand side you'll notice so I've labeled a distance but it could mean a

couple of things the distance you are from the issue but also the distance you are from the technical knowledge so most of the people in the room I'm assuming would be here you're really close to the security issue you have a lot of intellectual knowledge and expertise but think about this is really the the volume of people that were reaching with that message the further away you get from the issue and the further away you get from the technical expertise it becomes an emotional conversation right now this is being used really well by by news media and by government in terms of the fear tactics and the scary stories that are being sold we need to flip this on its head uh

you'll because you'll notice that the further you get towards an emotional argument the more people you're impacting so if our goal is to reach this many people our technical jargon is not going to get us there the way that we communicate with a mass audience needs to sign iFly shift into the emotional space and I want to talk a little bit um about outcomes um I I have a couple of examples that I'm going to put up on this screen which are my personal outcomes reasons why I do what I do just because I want you guys to see an example of what I actually mean by an outcome legal protection for security research I mentioned this at the

beginning it's something it's incredible L important to me security as a digital literacy I think it's incredibly important that we take basic internet and data security and make it a consumer available skill set right like when you got up this morning you locked your door on the way out of your house why do you do that that's a cultural norm Internet Security and data security is not yet a cultural norm for us and that's something that I'm working towards and then lastly the de glorification of criminal activity it drives me insane when I see stories in the news media that portray the criminal act um involved in some forms of hacking or or cyber attacks as somehow being the

coolest of the two options right like all the smart people are on the attack side actually it's a lot harder to do the defense and we don't do a good enough job of communicating that um to people outside of our community and we kind of LED that perpetuation of um the glorification of criminals um we let that grow and we let that fester and that is one of the reasons why government and consumers have this perception in their mind that those of us on the defense side haven't quite figured out what to do and so we obviously need a longer list of rules and boxes to check um because we you know the the criminals have the coolest

tools I will uh specifically call out what is not up here which may be shocking um for those of you who know some other professional communicators or as I like to call them PR bunnies um but media coverage is not up here that is not an outcome is not a goal it is a tool it is a channel it is a means to an end getting quoted in an article is not an accomplishment unless that article pushes the industry forward so when you guys do engage with media and when you do do other forms of Public Communication I want you to think about what is your real outcome right one story one article not the goal here but

how can we leverage those opportunities to push the to to push the industry forward and take one step towards our real outcomes now I want to move uh a little bit into something something different so Walter Litman is somebody that I'm intimately familiar with um anyone who I know there's a couple of people in here with Communications degrees probably know who who Walter is we had to learn about him in school um he's considered the father of public opinion and he kind of wrote the their dissertation on this subject back in 1921 um and many of the things that he wrote about um are still very accurate and hold true today and I want to share with you an in an excerpt

uh from that book because recently I've been seeing a lot of comments and a lot of complaints from the security Community specifically about news media right like they're always [ __ ] it up they can't get it right why are they writing like all these fud articles um and I want you guys the reason I'm here is because I want you guys to understand the space that we're operating in and I want you to understand the realities of this environment so that we can learn how to communicate successfully there are simply things about human nature and interpersonal communication that we can't change and so when I read this to you I want you to think does this sound familiar to

anything that we've heard recently you know nearly a hundred years later so it is because they are compelled to act without reli a reliable picture of the world that government schools newspapers and churches make such small Headway against the more obvious feelings of democracy against violent Prejudice apathy preferences for the Curious trivial as against the dull important and the hunger for sides shows and three-legged calves does this remind you of news media at all today guys this is reality it's 100 years later it's not changing um and I'll get into some more specific things about media later on but I want you guys to really be mindful of the fact that when you complain about reporters they

don't get better we just look like idiots because we haven't figured out how to work within that space um so now I want to take you through an exercise that I do with a lot of clients um called start stop continue um I want you guys these are suggestions and recommendations from for me you may disagree um and that's totally okay um but things that we should start doing as a community things that we should absolutely stop doing and things that we should continue doing that I actually think are are helping us so first is considering the bigger picture right I see lots and lots of articles with a researcher or a product manager um and it's obvious that they're

making comments with a very very small view of the world that we're operating in and probably aren't considering that their words are going to impact the way that that journalist or that policy maker is going to approach the next researcher or the next um security story collaborating with other disciplines I think is something that we desperately need help with um it's one of the reasons why I'm here it's one of the reasons that I have a job um because whether it's you know the CEO or um a journalist or a consumer or an advocacy group there's a lot of Translating that needs to be done um between disciplines and in particular I think the comm's

discipline um we need to do a better job of of roping them in whether it's your PR team or your marketing team they could be your best Advocate or they can be the biggest pain in your ass and the way that we approach them and the way that we communicate with them makes a big difference on how successful and how accurate they are in their Communications and they can also be a resource for you opposing bad research and reports literally one of my biggest pet peeves I hate the fact that the media will write every single goddamn flipping report that somebody puts out in a press release but that's the reality of it they're going to do that the news media

feed on those numbers and those statistics no matter how shitty the methodology is

yeah

y

yep no I I agree and in fact I think this is one of the reasons why we as a security Community are responsible because we're feeding that to them and that's what government reads that's what my mom reads if we're in this position it's because we did it to ourselves we are Our Own Worst Enemy when it comes to research and reports and again this is one of the reasons why I think it's so important to collaborate with PR and marketing dude go tell your marketing team that the thing they're about to put out is total [ __ ] help them understand why it's going to create more risk for the industry why it's perhaps

going to take more create more risk for your organization particular ly I think that's a really good point that it is difficult for people without the technical knowledge to decipher between what's [ __ ] and what's not and also particularly with with media they often don't have the time to look under the hood and just kind of you know scan what you know the ins and outs of all the methodology that that's being done but I think it's really important that we take ownership of that and that we make sure that the reports and the numbers and everything that's going out representing our community is real and is helpful selecting the right media opportunities right so this is something

that your PR team will never tell you but I'll tell you because I care about you it's okay to say no to interviews it's okay to not be part of a story if it's not the right story and it's actually a lot harder to stay out of the news than to get into it so you know when you have the opportunity to engage with media um just ask yourself is this the right kind of story for me for my organization and for the community and then prioritizing the consumer audience um so somebody had a really good question in one of the the earlier talks about how it's it's not just government that we're trying to um

reach but also the the consumers if we really want this to become um part of our culture and if we really want this skill set to be something that you know somebody like my mom can understand and easily adopt we have to think about um communicating to a consumer audience and again if you'll remember the chart that I showed you earlier the further away we get from the technical knowledge and the technical experience the more emotional those stories are going to become and need to become if we're actually going to pull people into it um think about uh the John Oliver interview with with Edward Snowden nobody G gave two shits about the NSA we start talking about

dickpics right that like I mean that's literally when I talk about the consumer audience that's where we have to get to right they're never going to become security engineers and we should stop expecting them to we've got to put ourselves in their shoes and think what is our outcome right what's the behavior what's the you know five years from now what do we want consumers to be doing you know maybe 12 months from now what do we want them to be doing and they're not going to get there with what we've been through throwing at them thus far in terms of things to stop doing um I really had to to limit myself with this list so I've prioritized the most

important things um this slide could have also been called like how not to be an [ __ ] 101 stop hyping all the like seriously you guys this hurts us it may be really cool and you may be really excited to call your mom and tell her that you're like you know stopping cyber warfare but that's not helpful um I put up Roberty Lee here um if you haven't read um his paper on the dangers and the negative outcomes of hyping um security I highly recommend it um but hype is really just detrimental to everybody it makes it makes it hard for us to pass um accurate and proper legislation and policy it makes it really difficult for consumers

to want to be part of this if it I'll tell you every time a consumer gets scared of something they go like this they Strongarm us uh ambulance chasing is I take it back if this is the one thing you walk away with from the stock it's this um ambulance chasing is where and I see lots of vendors do this when somebody has a data breach they're quick to jump in and point their fingers um and have a comment um but I want you to remember um that karma is [ __ ] and if you're pointing fingers at somebody else we all live in Glass Houses right um I also think it's important that we uh keep in

mind that in the business of security our most our most valuable asset is our customer trust I've seen companies lose really big deals and lose really important customers because their CEO does not believe that you can keep a secret we are in the business of Secrets if you're throwing other companies under the bus who's going to trust you and then attacking each other um I see this a lot on social media I wish I saw it less um but the example I want to share with you guys is uh you remember superfish and I saw so many people um calling for the removal of the entire Lenovo security team right because nobody in this room has ever lost a

battle with their product team nobody in this room has ever been told to go shove it by the attorneys I mean really you guys like those who are the loudest against other people remember that picture of Biff dude man we're selling tickets like for your breach in your issue because the louder you are against other people the more we're going to enjoy watching you fall remember people love a show and they don't rely on the media to educate the public like that's just lazy you guys it's not the reporter's job to translate very technical and very nuanced ideas to your target audience now do they have some responsibility in reporting accurately yes but all they

have to work with is what we provide them or what they can find so think about you know for example if we're going to go with the consumer audience do you have to go through the media do have to go through those extra steps and those potential filtering systems the it's 2015 lots of communication tools it is not the media's job to do this for us and then in terms of things I actually think we're doing really well and I think are being helpful um learning the culture and language of business this is incredibly important uh we've heard a lot of people already today talking about um understanding the needs and the priorities of regulators and business

Business Leaders they're not ever going to invest in security or give security the importance that it needs for the same reasons that we are and that's okay but we need to learn how to communicate with them in their language and in their culture so that the things that we believe in and the things that we know to be the right things are actually being invested and executed engaging through social media we we're sometimes we're great at this sometimes we're not um but I do really love to see the level of Engagement that the community has had um particularly on on Twitter in terms of generating conversation and debate around the issues that really matter um it's also

unfortunate that I you know I see a lot of researchers or a lot of Engineers when they're misrepresented in the media then start attacking a journalist on Twitter which is also not cool um it makes the rest of us look bad um there are more appropriate more professional more respectful ways to communicate um your disagreement or to you know help a reporter get it right um than just you know attacking people on social media um but keep educating journalists some journalists are going to take the time to learn this really well I would say over the last 12 months I've seen a hand F of reporters really gravitate to this as a real thing that

they're willing to dedicate themselves to um and they've put in the time and they've done their homework and you guys probably are thinking of the same people I am because we see them doing the right things consistently over and over again um but there are going to be those reporters who you know are responsible for your local six o'cl broadcast who simply don't have the time nor do they have the energy or the desire to get really good at this and so it's up to us to help educate them as quickly and as simply as we can so that the important message is getting um out to the public and then continue supporting the community um when I first got into this

nearly 10 years ago somebody told me once you get into security you're never going to get out um that it just is this family and this community that you get sucked into and that's absolutely true and I think that is one of our greatest assets in terms of supporting each other um I also think it's one of our greatest challenges because we put up a lot of barriers between ourselves and those outside our community and that isolation makes it really difficult for us to communicate effectively uh and so then of course I want to just uh leave you guys with a couple of tips um for working with media there's a lot of talks and a lot

of conversation coming from incredibly smart experts on this already so I'm going to try to build on things that you may have heard in the past rather than duplicate them but seek respect not attention um I mentioned looking for the right media opportunities it's really more important that our community has respect than that we get more attention we have more attention than we know what to do with right now and most of it is bad you are a resource you're not the story don't take it personally if the reporter does not right that you're like the [ __ ] rock star of infosec um and off the Record is a myth and I know that a lot of people bring

this up um in regards to the fact that anything you say is fair game but I want to mention um something else that's really important to keep in mind is off the Record isn't a myth not solely because of what shows up in print but because of what doesn't show up in print every engagement you have with a journalist impacts and influences the way that they think about our community and the way that they're going to interact with the next you know security professional or researcher based on what you said so it doesn't really matter if it shows up in print or not you have forever change that relationship because of the discussion and the conversation

that you have journalists are really busy um a good journalist is working on at least 10 stories at a time and they don't understand security most of them and that's okay stop hating them for not understanding security we need to do a better job of educating those who are interested and for those who aren't prioritizing Security in their reporting we need to do a better job of removing the jargon removing the technical language and if it's for the six o'clock news give them three [ __ ] bullet points that my mom can understand and a lot of them care mostly about the crime right so there's a lot of comments a lot of um complaints about

you know how reporters are not covering the solutions or the answers well you know what sunshine and rainbows doesn't sell very well um and so just keep in mind again we talk about selecting the right media opportunities a lot of security reporters are actually like crime investigative reporters they're never going to tell that story that you want them to don't hold it against them that is their job and maybe this just isn't the right um conversation for you to be part of so hacker or criminal we get to decide this is time for us to take back control um to be really thoughtful and strategic in the way that we communicate and the words that we use to represent our

community um so I will put it back on you guys in terms of you know this is a start to a conversation where do we go from here I think there's more conversation for us to have as a community and I think that there are more opportunities for us to decide what those outcomes need to be I shared some of my personal outcomes but we as a community need to start deciding who we're going to be so any questions yeah so you were saying that you know media is just one channel and that maybe like owned is a way of messages especially bring the technal down to are there some channels that find our most successful in reaching

that audience sure so I think a lot of it depends on the specific audience um but I think I'm sorry oh I'm sorry so the question was media is just one tactic one channel um one means to an end what are some of the other uh channels and tactics that are particularly um effective in in reaching an audience and so I think if it's a consumer audience I think um there are companies who do do a really good job um with their blog um I think social media is a really good um Channel I think it's about taking your message where your audience already is um and so this is this is a critical piece of um what we do as professional

communicators is identify where that audience already is um because we can't have the expectation that they're going to come to us so social media is one blogging is one um I think there's a lot of really great um inperson Community interaction a lot of security researchers and Engineers who are going and um doing things in their local community um so I think I mean those are just a couple but I think the real question is who are you trying to reach and where are they already located so that you can bring your message to them yeah how do we as our do you want me to send you a list just like Twitter handles so the question was how do we find that

assholery in our own Community oh fight it oh I was like oh I already got a list um I I think part of it so I think part of it is um you know do the best you know response to a fool is silence right so the public kind of shaming of that I think is just going to perpetuate the problem I think where we really need to do a better job is giving voice to those other um those other ideas and those other Personalities in our community we don't have to rely there really is no solution for an [ __ ] right they they just are that way um but there's a lot of people in

our community who are wonderful people and contributing significantly to the betterment of security and they need a voice they need a louder platform um and so that would be my best advice is making the good stuff louder than the bad stuff

yeah

right yep so a lot of this goes back to um I made the point about not relying on the media to do our job for us um there's no reason why we have to be dependent on a journalist to tell our story when we can go to DC and do it just get in the room with those people um and I think part of it there's a lot of things about security that will sell that we're not doing a good enough job of whether it's that typical good versus evil narrative or you know the David and Goliath story or um you know the contributions that our community is making to the Next Generation in the

investment that we're putting into children um I think is incredibly important and has a really strong uh human interest angle to it um so there are ways that we could do a better job with media but I think the answer is not waiting for them to catch up to us right they go around them um there's no reason why you know we we have to cross our fingers and hope that some editor or some journalist is going to you know say what we want to say when we can just say it

ourselves

yes yeah absolutely so the comment was that there are some security vendors and security researchers who have really good blogs who do a really good job of breaking down some of those more complex ideas and communicating it in easy to understand language and the media do pick up on that um it makes their job a whole lot easier like I said reporters are really busy um if you can make this easier for them do do the heavy lifting for them um that that can go a long way are there any other questions yeah Alan

yeah so I so I will actually say um and you know I'm going to have a lot of of I'm putting a Target on my back right now um but I think the biggest the best way that we can impact that problem is going after our own PR and marketing teams um I don't know a researcher who puts out those types of reports all by themselves it's usually in the form of a press release through you know some PR team so go after them that would be my recommendation I think they're one of the biggest obstacles we have are uninformed um Communicator so just like I'm here now giving you guys a little bit of communication

Insight I talk to the communicators giving them security Insight because they don't understand that by going out with some of these numbers and some of these reports um which journalists can't tell our [ __ ] actually makes it really difficult for us to be successful in actually securing things right this is why media coverage is not an outcome it's a sometimes it's a problem sometimes it's a tool um but we as a community need to decide what our goals are what the results are um and what the outcomes are that we're striving towards and make those whenever you have to make a communication decision keep those outcomes in mind because that's where we want to move more media coverage isn't

going to help us if it's the wrong type of coverage any other questions yeah said one of your goals was to deify the criminal side of the equation and how do you go about doing that because sort of that's the criminal side of the you know let's watch eform while we watch Sony go down to flames and the successful defensive side is nothing happened today so how do you even start on that so I I think one of the things that that we haven't done really well is the defense side is like [ __ ] interesting you guys like you're in this career because it's fun and it's interesting right and it means something why isn't that story

out there why aren't we doing a better job telling that story and I think sometimes it's because those of you who are who hold the keys to some of our most interesting stories maybe don't have the communication tools to get it out there and that's why collaboration with other disciplines is so important because we can help do that right those of us who have been professionally trained to do this kind of stuff actually need people like you because you're a really cool story that nobody knows about yet any other question yeah I

news comes around very very frequently do you think's more communication training stories out like covered a lot cover lot of cover a lot collaboration work doesn't get the bigest the industry yeah I mean not to be a dead horse but I really think education of the communications professionals is critical because they're selling fear because it's easier and because that's what's kind of falling out of the sky for them right so secur fear and and scary things sell not just in media but for your marketing team and for your sales team so think about what are we arming them with when they represent our community when they're talking to a journalist or you know to to an audience

such as this do they have in their back pocket those positive stories that are like yeah so there people trying to attack us we've got a kick-ass badass security team doing all this [ __ ] over here like that's actually helping um I think sometimes the communications um Community can actually make it more difficult for you guys so I'm not here to apologize for them they know how I feel about that um but you know if you guys could could help teach us that would be super super

helpful yeah yeah absolutely it's a good point are there any other questions I know we just have a couple minutes yeah just you mentioned something about the community that really to me was it the Biff photo part of what I see in the community is that we seem to accept making the same mistakes over and over particularly in the ab side maybe within the community we can just do better at not making the same mistakes over yeah I agree there seems to be kind of that lack of body of knowledge that maybe exists in other scientific Fields where there's you know here's the body of knowledge I mean this I'm opening a huge can of worms because goes into

education and information sharing and all of that but I think to your point there there are opportunities for us to to learn from mistakes so we don't repeat them um and part of that you know it's one of the reasons why events like this are so important because this is I think a pillar of how we share ideas and information with the community and how we share what we've learned so that we don't repeat those mistakes anything else tter uh so my Twitter handle is IM Melanie and it's i m e l u n y it's also on the slide but I guess it's really small it's not like I get paid to do stuff like this I don't know why I would

make it readable all right thanks so much you guys you've been

great [Applause] all right folks thank you that was Melanie ensen uh please join us after the break next we've got coming up Jesse Irwin talking about